Authentication

Every Public API request requires a user API token created from Settings → Public API in the PostlyBee dashboard. Tokens can access every managed workspace or an explicit workspace allowlist. They also carry scopes such as posts:read, posts:write, and analytics:read. A scope limits what a token may do; it never grants access to a workspace that the token owner no longer manages.

Bearer header

Send the token in the Authorization request header using the Bearer scheme:

Authorization: Bearer YOUR_API_TOKEN

Start by listing the workspaces available to the token:

curl https://api.postlybee.com/public/v1/workspaces \
  --header "Authorization: Bearer $POSTLYBEE_API_TOKEN"

const response = await fetch('https://api.postlybee.com/public/v1/workspaces', {
  headers: {
    Authorization: `Bearer ${process.env.POSTLYBEE_API_TOKEN}`,
  },
});

const workspaces = await response.json();

import os
import requests

response = requests.get(
    "https://api.postlybee.com/public/v1/workspaces",
    headers={
        "Authorization": f"Bearer {os.environ['POSTLYBEE_API_TOKEN']}"
    },
)

workspaces = response.json()

Workspace access

Workspace resources use the workspace ID in the path:

/public/v1/workspaces/{workspaceId}/posts

The API verifies all three conditions on every request:

The token is active and not expired.
The workspace is included in the token’s allowlist.
The token owner is still an active owner or manager of the workspace.

An unavailable workspace returns 403 Forbidden. Passing a resource ID from another workspace does not bypass this check.

Scopes

Scope	Access
`workspaces:read`	List available workspaces and verify a workspace connection.
`accounts:read`	List accounts, settings schemas, and provider tools.
`accounts:write`	Connect and delete social accounts.
`posts:read`	List posts and inspect missing provider content.
`posts:write`	Create, update, and delete posts.
`media:write`	Upload, import, and generate media.
`analytics:read`	Read account and post analytics.
`notifications:read`	List workspace notifications.
`mcp:read`	Use read-only tools through a static-token MCP connection.
`mcp:write`	Use MCP tools that create posts or generate media.

Missing required permissions return 403 Forbidden with the required scope names.

Token lifecycle

The raw token is shown once when it is created. PostlyBee stores only its SHA-256 hash. From Settings you can review its prefix, scopes, workspace access, expiration, and last-used time, or revoke it immediately.

Store tokens in a managed secret store. Never expose them in browser code, query strings, public repositories, screenshots, or client-side logs.

Public API tokens and OAuth-issued MCP access tokens both use the Bearer header, but they are different credentials and cannot be interchanged.

Get started

Essentials

MCP

CLI

SDKs

API reference

Bearer header

Workspace access

Scopes

Token lifecycle

​Bearer header

​Workspace access

​Scopes

​Token lifecycle

Bearer header

Workspace access

Scopes

Token lifecycle